jtcsv 2.2.6 → 2.2.8

package/json-save.js

@@ -21,17 +21,22 @@ const {
  */
 function validateJsonFilePath(filePath) {
   const path = require('path');
-  
+
   // Basic validation
   if (typeof filePath !== 'string' || filePath.trim() === '') {
     throw new ValidationError('File path must be a non-empty string');
   }
-  
+
   // Ensure file has .json extension
   if (!filePath.toLowerCase().endsWith('.json')) {
     throw new ValidationError('File must have .json extension');
   }
-  
+
+  // Block UNC paths BEFORE path.resolve() to avoid network lookup timeouts
+  if (filePath.startsWith('\\\\') || filePath.startsWith('//')) {
+    throw new SecurityError('UNC paths are not allowed');
+  }
+
   // Get absolute path and check for traversal
   const absolutePath = path.resolve(filePath);
   const normalizedPath = path.normalize(filePath);

package/json-to-csv.js

@@ -427,17 +427,22 @@ function preprocessData(data) {
  */
 function validateFilePath(filePath) {
   const path = require('path');
-  
+
   // Basic validation
   if (typeof filePath !== 'string' || filePath.trim() === '') {
     throw new ValidationError('File path must be a non-empty string');
   }
-  
+
   // Ensure file has .csv extension
   if (!filePath.toLowerCase().endsWith('.csv')) {
     throw new ValidationError('File must have .csv extension');
   }
-  
+
+  // Block UNC paths BEFORE path.resolve() to avoid network lookup timeouts
+  if (filePath.startsWith('\\\\') || filePath.startsWith('//')) {
+    throw new SecurityError('UNC paths are not allowed');
+  }
+
   // Get absolute path and check for traversal
   const absolutePath = path.resolve(filePath);
   const normalizedPath = path.normalize(filePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jtcsv",
-  "version": "2.2.6",
+  "version": "2.2.8",
   "description": "Complete JSON<->CSV and CSV<->JSON converter for Node.js and Browser with streaming, security, Web Workers, TypeScript support, and optional ecosystem (zero-deps core)",
   "main": "index.js",
   "browser": "dist/jtcsv.umd.js",